Signing Certificate Signing Requests with OpenSSL: In-depth Comparison of x509 and ca Modules with Practical Guide

Introduction

In Public Key Infrastructure (PKI) systems, signing Certificate Signing Requests (CSRs) is a fundamental process for establishing trust chains. OpenSSL, as a widely used cryptographic toolkit, provides multiple methods for signing CSRs, with the x509 module and the ca module being the most commonly employed. This article compares these two methods from technical principles, implementation approaches, and practical applications.

OpenSSL Configuration Fundamentals

Before initiating signing operations, proper configuration of the OpenSSL environment is essential. Configuration files define default certificate parameters, extension fields, and signing policies.

CA Configuration File Example

HOME            = .
RANDFILE        = $ENV::HOME/.rnd

[ ca ]
default_ca    = CA_default

[ CA_default ]
default_days     = 365
default_md       = sha256
preserve         = no
x509_extensions = ca_extensions
copy_extensions = copy

[ req ]
default_bits       = 4096
default_keyfile    = cakey.pem
distinguished_name = ca_distinguished_name
x509_extensions    = ca_extensions

[ ca_distinguished_name ]
countryName_default = US
stateOrProvinceName_default = Maryland
localityName_default = Baltimore
organizationName_default = Test CA, Limited
commonName_default = Test CA

[ ca_extensions ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always, issuer
basicConstraints       = critical, CA:true
keyUsage               = keyCertSign, cRLSign

Server Configuration File Example

[ req ]
default_bits       = 2048
default_keyfile    = serverkey.pem
distinguished_name = server_distinguished_name
req_extensions     = server_req_extensions

[ server_distinguished_name ]
countryName_default = US
stateOrProvinceName_default = MD
commonName_default   = Test Server

[ server_req_extensions ]
subjectKeyIdentifier = hash
basicConstraints     = CA:FALSE
keyUsage             = digitalSignature, keyEncipherment
subjectAltName       = @alternate_names

[ alternate_names ]
DNS.1  = example.com
DNS.2  = www.example.com

Certificate Authority Establishment

Creating a self-signed CA certificate is a prerequisite for signing operations. Use the following command to generate CA certificate and private key:

openssl req -x509 -config openssl-ca.cnf -days 365 -newkey rsa:4096 -sha256 -nodes -out cacert.pem -outform PEM

This command generates cacert.pem (CA certificate) and cakey.pem (CA private key). Note that the -nodes parameter omits password protection, which poses security risks in production environments.

Certificate Signing Request Generation

Generate CSR for end entities (e.g., web servers):

openssl req -config openssl-server.cnf -newkey rsa:2048 -sha256 -nodes -out servercert.csr -outform PEM

This operation produces servercert.csr (certificate request) and serverkey.pem (server private key). The key difference is the omission of the -x509 parameter, which would otherwise generate a certificate directly instead of a request.

Signing Method Comparison

x509 Module Method

The x509 module provides direct certificate operations with the following signing command:

openssl x509 -req -days 360 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

Characteristics of this method:

• Simplicity: Single command completes signing without complex configuration
• Flexibility: Suitable for ad-hoc signing operations
• Lacks State Management: Does not maintain certificate database, making tracking difficult

ca Module Method

The ca module is specifically designed for certificate authorities and requires comprehensive configuration:

openssl ca -config openssl-ca.cnf -policy signing_policy -extensions signing_req -out servercert.pem -infiles servercert.csr

Characteristics of this method:

• Professional Completeness: Maintains certificate database and supports Certificate Revocation Lists (CRLs)
• Policy Control: Implements fine-grained access control through configuration files
• Steep Learning Curve: Requires understanding of complete PKI architecture

Key Configuration Parameters Analysis

Extension Field Handling

The copy_extensions = copy parameter is critical, ensuring that extension fields from the CSR (such as Subject Alternative Names) are copied to the final certificate. Omitting this parameter results in missing SAN fields, causing certificate validation failures in modern browsers.

Subject Uniqueness Control

unique_subject = no allows issuing multiple certificates for the same subject, suitable for testing environments. Production environments typically set this to yes to ensure subject uniqueness.

Policy Matching Rules

Control certificate field matching through the [ policy_match ] section:

[ policy_match ]
organizationName = match  # Requires consistent organization name
# or
organizationName = supplied  # Allows variation in organization name

Security Considerations

Essential security risks to address during signing operations:

• Private Key Protection: Always password-protect CA private keys; avoid using the -nodes parameter
• Request Verification: Verify CSR integrity and authenticity with openssl req -verify before signing
• Extension Field Review: Carefully inspect extension fields in CSRs to prevent signing certificates with CA capabilities
• Certificate Lifecycle Management: Set appropriate certificate validity periods and regularly update CRLs

Practical Recommendations

Choose the appropriate signing method based on usage scenarios:

• Ad-hoc Testing: Use the x509 module for quick signing
• Production Environment: Employ the ca module to establish a complete PKI system
• Development Environment: Configure unique_subject = no to facilitate repeated testing
• Browser Compatibility: Ensure proper SAN field configuration to avoid Common Name (CN) validation issues

Conclusion

Both the x509 and ca modules have distinct advantages, with the choice depending on specific requirements. For simple, temporary signing, the x509 module offers a convenient solution, while the ca module's professional features are indispensable for production environments requiring comprehensive certificate management. Regardless of the method chosen, proper configuration, stringent security controls, and ongoing maintenance are crucial for ensuring reliable PKI system operation.